2592 matches found
Sql injection
PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account...
CVE-2021-28245
PbootCMS 3.0.4 contains a SQL injection vulnerability in index.php via the search parameter that can be exploited to add an administrator account and reveal sensitive information. This CVE (CVE-2021-28245) is documented across multiple feeds (NVD, Red Hat, CNVD, CVE lists) with consistent descrip...
CVE-2021-28245
PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information through adding an admin account...
Controlled Admin Access < 1.5.6 - Improper Access Control to Privilege Escalation
The plugin did not properly restrict access when checking user with limited access, allowing them to query pages they should not be able to, which could lead to privilege escalation by creating a new administrator with full, unrestricted access to the blog. PoC Created a temporary admin account v...
Project Expense Monitoring System 1.0 Authentication Bypass Vulnerability
Exploit Title: Project expense Monitoring System | Create Admin Account Unauthorised Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/14001/project-expense-monitoring-system-project-php-source-code-2020.html Software Link:...
Rocket.Chat: Post-Auth Stored XSS with User Interaction leads to Remote Code Execution
Summary: Unsafe usage of the toastr library leads to Stored XSS when combined with a validation bypass in the createRoom function. Targeting an admin account leads to Remote Code Execution. Description: The frontend uses the toastr library to display error messages to the user. However, it is use...
Rocket.Chat: Pre-Auth Blind NoSQL Injection leading to Remote Code Execution
Summary: The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taking over an admin account leads to Remote Code Execution. Description: The getPasswordPolicy...
VoIPmonitor WEB GUI 24.55 Cross Site Scripting
VoIPmonitor WEB GUI vulnerable to Cross-Site Scripting via SIP messages - Fixed versions: VoIPmonitor WEB GUI 24.56 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-02-voipmonitor-gui-xss - VoIPmonitor Security Advisory: none, changelog references fixes ...
CVE-2021-3273
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system...
U.S. Dept Of Defense: Blind Stored XSS on ███████ leads to takeover admin account
Hello Team, I am Hemant Patidar working as a security researcher and I found a bug in your site. Report of bug is as follows:- Vulnerable URL: https://████████/ Description: I have found that various field of the profile page is not properly configured to wipe out HTML tags and Javascript code...
[ASA-202102-29] keycloak: cross-site scripting
Arch Linux Security Advisory ASA-202102-29 ========================================== Severity: High Date : 2021-02-20 CVE-ID : CVE-2021-20195 Package : keycloak Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1578 Summary ======= The package keycloak before...
CVE-2020-27997
An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery CSRF protection may lead to elevation of privileges e.g., /admin/customer/create to create an admin account...
CVE-2020-27997
An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery CSRF protection may lead to elevation of privileges e.g., /admin/customer/create to create an admin account...
CVE-2020-27997
An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery CSRF protection may lead to elevation of privileges e.g., /admin/customer/create to create an admin account...
Ninja Forms WordPress Plugin Opens Websites to Hacks
Click to Register Ninja Forms, a WordPress plugin used by more than 1 million sites, contains four critical security vulnerabilities that together make it possible for a remote attacker to take over a WordPress site and create various kinds of problems. Ninja Forms offers WordPress site designers...
CVE-2021-27167
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters are generated in init3bbpassword in libciadaptationlayer.so...
CVE-2020-24271
A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=&password=...
Cross site request forgery (csrf)
A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=&password=...
CVE-2020-24271
CVE-2020-24271 concerns a CSRF vulnerability in EasyCMS v1.6 that allows an attacker to add an administrator account by requesting index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent and submitting username and password. The issue arises from a cross-site request issue ...